Privacy notice

Who is responsible

Gibox Oy (business ID 3522481-3), Helsinki, Finland, is the controller of the personal data described here. You can reach us at support@robocaller.io.

When we decide, and when your company does

When your company decides, its own privacy notice applies to that data. Our data processing agreement sets out how we handle it for you.

What we collect, why and for how long

We need your account and billing details to provide Robocaller. Anything else you give us is voluntary.

If your details are in our lead database

Robocaller customers search our database of Finnish companies and the people who work there, so they can contact the right person about their products and services.

• What we hold: your name, job title, employer, and work email address or phone number.
• Where it comes from: the Finnish trade register (PRH and YTJ), your company’s website, public professional profiles such as LinkedIn, and work contact details that Robocaller customers add to their own CRM. We may also get or check a work email address from Icypeas, a French contact data provider, or work one out from the company’s address format. You can ask us which source your details came from.
• Why: our legitimate interest, and our customers’, in sales between businesses. We have weighed it against your interests, and you can ask us for that assessment.
• Who sees it: Robocaller customers. A customer who adds you to its own workspace is the controller of that copy.

You can object at any time. Email support@robocaller.io and we’ll remove you from the database and block your details from being added again. If a customer already has your details, we’ll tell you who to contact or pass your request on.

Who we share data with

We share personal data only with these recipients, and only what each one needs:

• Service providers that process data for us, only on our instructions: cloud hosting and database (Finland and France, with some support access from outside the EU), AI services (mainly the United States), telephony and text messaging (Ireland and the United States), LinkedIn connection (France, with some traffic through the United States, Singapore and Israel) and email address lookup (France). Our subprocessor overview says what each kind receives.
• Telephone network operators and our telephony provider, which carry calls and text messages and are independent controllers of the traffic data.
• Our payment provider and our e-invoicing operator, to take card payments and deliver our invoices. The payment provider is also an independent controller for fraud prevention, anti-money-laundering checks and some of its own purposes.
• The email and office software we use to run our own business, and professional advisers such as our accountant and lawyers when needed.
• Google, Microsoft and LinkedIn, when a user connects an account there. They receive what is needed to send the user’s messages and handle it under their own terms.
• Robocaller customers, who can see the company and contact details in our lead database. A customer that adds you to its workspace is the controller of that copy.
• Authorities, only when the law requires it.

We don’t sell personal data. If you want the names of the companies that have received your data, email support@robocaller.io and we’ll tell you.

Transfers outside the EU and EEA

Some of our providers, or their own subprocessors, process personal data outside the EU and EEA, mainly in the United States and in some cases Singapore or Israel. Most of them are AI, telephony and LinkedIn connection services. Those transfers rely on the EU–US Data Privacy Framework, the European Commission’s adequacy decision for Israel, its standard contractual clauses or a provider’s binding corporate rules, as set out in each provider’s data processing terms. You can ask us which safeguard applies and for a copy of it.

AI in Robocaller

Robocaller uses AI services to draft messages, sort incoming replies, transcribe and summarise calls, hold voice calls and run the in-app assistant. We don’t make decisions about you that are based only on automated processing and have legal or similarly significant effects.

Google Workspace data (Gmail and Google Calendar)

A user can connect their Google account to Robocaller.io so that they can send campaign email from their own mailbox, see the replies they receive, and have meetings booked into their own calendar. This section describes how we handle that data specifically. The rest of this notice applies to it as well.

What we access, and why

• Sending email (gmail.send): to send only the messages the user or their campaign has composed.
• Reading replies (gmail.readonly, gmail.modify): to find replies to messages sent through Robocaller.io, so a reply can be shown in the app and the campaign can stop contacting that person. Mailboxes connected before September 2026 granted these scopes and are still read under them; new connections no longer request them.
• Calendar (calendar.events): to read busy times so a booking page offers only free slots, and to create the meeting when someone books one.
• Your email address (userinfo.email): to show which mailbox or calendar is connected.

We ask for nothing beyond what these features need, and we use the access only for the features described here.

What we store

For a message we send through the service we store the subject, the sender and recipient addresses, the Gmail message and thread identifiers, and the text of the message as we sent it. That text is composed in Robocaller.io — it is the customer’s own outgoing message rather than content read out of their mailbox. For attachments we send, we store the file name, type and size — never the contents. For a meeting booked through the service we store the calendar event identifier, the start and end time, the title and the attendee’s address.

For an incoming email we store only a short extract of at most 200 characters, never the full text. Where the longer text is needed — for example to draft a reply — it is read from Gmail at that moment and is not retained.

These records are not deleted automatically. A customer can ask us to delete them at any time, and disconnecting a mailbox stops any further access immediately.

Who we share it with

Google user data is shared with the following types of party, and with no others.

We do not sell Google user data, we do not use it for advertising or to build advertising profiles, and Robocaller.io contains no advertising, retargeting or marketing-analytics code.

Aggregated and anonymized data

We do not create aggregated or anonymized data sets out of Google user data, and so we share none. Everything we derive from a message — an intent label, a sentiment, a summary — stays attached to the identified contact and to the single customer workspace it came from.

Limited Use

Robocaller.io’s use of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements. This applies to raw Google user data and to anything derived from it.

We do not train AI models. We do not use customer data, message content or Google user data to create, train, fine-tune or improve any foundational or generalized machine-learning or artificial-intelligence model, whether ours or a provider’s.

In particular, we do not transfer Google user data — raw, aggregated or anonymized — to any third party that would use it to create, train or improve generalized or foundational artificial-intelligence or machine-learning models. The AI providers we use (see AI in Robocaller) process this data only to return a result to the user who asked for it.

Who can read it

Our staff do not read the contents of a connected mailbox or calendar. Access is limited to what is necessary to operate or repair the service, to investigate a security incident, to comply with the law, or where a customer has asked us to look at something specific.

Withdrawing access

A user can disconnect a mailbox or calendar at any time in Robocaller.io, which asks Google to revoke our access. Access can also be withdrawn directly at google.com/permissions (opens in a new tab). Either way, all further access stops.

Cookies

This website and the app use only the cookies and browser storage they need to work, for example to keep you signed in and remember your language. We don’t use advertising cookies. If we add analytics, we’ll ask for your consent first.

Your rights

You can:

• see what we hold about you and get a copy
• have wrong details corrected
• have your data deleted
• restrict how we use it
• object to processing based on legitimate interest, and to direct marketing at any time
• get data you gave us in a machine-readable format, where the law gives you that right

Email support@robocaller.io. We reply within one month. If a request is complex, we may need up to two more months, and we’ll tell you if so. If your request is about data a Robocaller customer holds, we pass it on to them.

You can also complain to the Data Protection Ombudsman (tietosuojavaltuutettu) at tietosuoja.fi (opens in a new tab).

Changes to this notice

When we change this notice, we update the date at the top of the page. If a change affects how we handle customers’ data, we tell them by email before it takes effect.